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METHOD FOR MONITORING THE PERFORMANCE RELIABILITY 
OF A CONTROL UNIT AND DIAGNOSTIC DEVICE 

Related Art 

The present invention relates to a method for monitoring the performance reliability of a 
control unit and/or at least one sensor of a safety device for the protection of vehicle 
occupants, as well as a diagnostic device. 

Safety devices for the protection of vehicle occupants such as front and side airbags, rollover 
bars, belt tighteners etc., are standard equipment in motor vehicles manufactured these days. 
Typically, such safety devices are made up of a multitude of sensors for detecting a crash by 
recording a crash-related negative acceleration or velocity, and a control unit for the safety 
device, which analyzes a value derived from the crash. If a specific threshold value, which 
points to the presence of a crash, is detected, the control unit triggers the corresponding 
restraining means. 

As is often the case in electronic devices, there is the risk in control units and/or in sensors as 
well that they will not function or will not function properly, Which, however, must be 
avoided under all circumstances when safety devices are involved. Modern safety devices for 
the protection of vehicle occupants therefore include devices for checking the correct 
functioning of the sensors and/or the control unit, thereby detecting a malfunction as early as 
possible. 

For the most reliable operation of a safety device in a motor vehicle it is of crucial 
importance that the crash sensors (such as acceleration sensors, deformation sensors) and the 
corresponding control unit operate without faults at all times. If the performance reliability of 
a crash sensor or a control unit is interrupted, this must be signaled immediately so that the 
required repair and exchange may be initiated. 

Safety-relevant electronic devices to which the life of vehicle occupants is entrusted in a 
dangerous situation, must have extraordinary performance reliability. In most cases such high 
performance reliability can be guaranteed only if all components of the safety device are able 
to be checked with respect to their functioning. 
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In the method- for checking an acceleration sensor of the safety device, a test signal is applied 
to the particular acceleration sensor whose proper functioning is to be tested. The answer 
signal transmitted by the acceleration sensor in response to the test signal will then be utilized 
as a measure for ascertaining the functioning of the acceleration sensor. These function tests 
5 of the acceleration sensor are carried out continuously during normal operation of the safety 
device, for instance when starting the vehicle. 

As far as the general background of the test for correct functioning of acceleration sensors is 
concerned, reference is made to the laid-open documents DE 44 39 886 Al, DE 37 06 765 
Al, DE 37 36 294 Al, DE 43 02 399 Al, DE 197 57 1 18 Al as well as the German patent 
10 document DE 32 49 367 CI. 

In control units for safety devices for the protection of vehicle occupants and their remote 
sensors there is also always the risk that they get damaged in a crash. This type of damage 
depends mostly on the severity of the impact. If the impact, and thus the deformation, is 
severe enough to deform the location at which the control unit or the appropriate sensors is 

15 affixed, the impact may have damaged the control unit and/or the sensors as well. Such 

damage may be so severe that the control unit or the sensors are no longer operable. In this 
case these devices would have to be exchanged. Despite an impact and a resulting 
deformation it is entirely possible, however, that the control unit and individual sensors are 
still working properly, so that there is no need to replace them. Furthermore, it is possible that 

20 the control device or the sensors have indeed been damaged slightly by the impact, but in the 
beginning are still fully functional nevertheless. However, there is the risk in this case that 
these devices lose their functionality over the course of time, for instance due to mechanical 
influences such as vibrations, temperature or the entry of moisture, or stop functioning in 
another accident. In this case these devices should have been exchanged after the original 

25 impact. 

However, it is very difficult to distinguish the mentioned scenarios from each other. In 
particular in the case of a still operative devices it is not easy without further measures to 
determine whether and when this unit will possibly malfunction. 

In control units for safety devices, in particular in the case of airbag control units, these are 
30 therefore exchanged, typically after one to five crashes during which the control unit has 
triggered at least one restraining means. In the case of crash sensors, there are often no 
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regulations whether and, if so, under what circumstances these should be exchanged in the 
event of a crash. 

A related problem also arises from the fact that, especially in service facilities with less 
experienced staff, all control units and crash sensors are often exchanged because of a crash 
5 although some of them are still working perfectly. As an alternative, there is also the 
possibility that, for instance, a fully functioning control unit is exchanged, whereas an 
acceleration sensor, for example, which no longer provides full operability, is not replaced. 

Summary of the Invention 

The present invention solves the problems of the related art by a method having the features 
10 of Claim 1, and a diagnostic device having the features of Claim 7. 

The principle on which the present invention is based is that the control unit or a comparable 
device decides on its own whether the control unit should be exchanged in the aftermath of a 
crash. In addition or as an alternative, the control unit or a comparable device may also 
decide whether and, if so, which sensors should be exchanged in the event of a crash. This 
15 minimizes the repair costs resulting from a crash since only control units or sensors that are 
not fully functional are replaced, whereas the operative devices may continue to be used. This 
also minimizes the risk of a control unit or a sensor failing in a crash. 

An additional advantage of the method according to the present invention is that this 
functionality must be described in the corresponding manuals and system specifications of 
20 the vehicle manufacturer, the service facility testing devices and vehicle manuals, which 
leads to high transparency and ensures excellent verifiability of the method. 

Advantageous embodiments and further refinements of the present method are mentioned in 
the subclaims and in the specification with reference to the drawing. 

In one very advantageous embodiment a value for the impact severity is calculated not only 
25 for each control unit but for each sensor as well, this value being calculated in a device- 
specific manner. The individually calculated value for the impact severity of the control unit 
or sensor in question will then be compared to a predefined threshold value. As a rule this 
threshold value is also predefined specifically for the individual control unit or the individual 
sensor. This means that, depending on the location of the individual control unit or the sensor 
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inside £he motor vehicle, and depending on its mechanical properties, a threshold value 
adapted thereto may be predefined in each case. Furthermore, the threshold value naturally 
may also depend on other parameters such as the mechanical stability of the particular device. 

In a further advantageous refinement, information from several preceding impacts is also able 
to be taken into consideration when determining the value for the impact severity of the 
control unit. In particular, this functionality provides, for instance, that preceding impacts in 
which the control unit has triggered will be taken into account as well when determining the 
impact severity of a new impact. As a result, a detected renewed impact may be assigned a 
relatively higher value for the impact severity than an equally heavy impact which was not 
preceded by an earlier impact, this being accomplished by scaling with a correction factor, for 
instance. As an alternative, it is also conceivable that the predefined threshold value is 
lowered in a repeat impact. In an advantageous manner, this refinement according to the 
present invention thus takes the possibility into account that the control unit has sustained 
damage in an earlier impact already. 

In another advantageous embodiment, the absolute value of the predefined threshold value is 
lowered with increasing operating time of the safety device. This takes the fact into 
consideration that, with increasing operating time, the control unit or the sensors no longer 
work as well compared to their original state, for instance, even without impact and thus 
without resulting damage, due to external influences, such as vibrations, temperature 
influences, improper handling etc. 

One advantageous refinement uses measurements from crash tests and calculations and 
findings derived therefrom to determine the predefined threshold value. Vehicle 
manufacturers are able to define for each model variant how high the predefined threshold 
should be selected as a function of the particular velocity, vehicle impact, impact type etc. 
25 For instance, prior to the initial operation of a safety device in a motor vehicle, a multitude of 
crash tests must be carried out to test this safety device. Such crash tests then yield empirical 
values or other findings for the predefined threshold at which the corresponding sensors and 
control units do stay operative after a crash, but it turns out ultimately that the performance 
reliability can no longer be ensured in long-term testing. 
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4 



In an advantageous refinement, a testing device of a service center reads out and analyzes the 
output function-error signal. In addition or as an alternative, this may also be done by the 
control unit itself 



In the latter case the diagnostic device will require an output unit, which informs the vehicle 
5 user of an occurring error signal. This output unit may be realized in the form of a blinking 
light, for instance. Furthermore, it may of course also be provided in the functionality of an 
onboard computer installed in the motor vehicle. In an advantageous refinement it is possible 
to infer from the error signal which control unit or which sensor is no longer fully 



10 In a very advantageous embodiment, the functionality of the diagnostic device may be 

implemented in the control unit itself, either entirely or at least partially. In the event that the 
measured or calculated value for the impact severity exceeds the predefined threshold value, 
the diagnostic device emits a function-error signal either to a service station testing device or 
to a program-controlled unit. In an advantageous manner a control-unit-typical or sensor- 

15 typical threshold value is provided for this control unit or for each sensor. This predefined 
threshold value is lower than a threshold value specified for the triggering of a restraining 
means. 

Brief Description of the Drawings 

The present invention is explained in greater detail in the following with reference to the 
20 exemplary embodiments shown in the drawings. 

The figures show: 

Figure 1 The block diagram of a safety device in a motor vehicle having the diagnostic 



functioning. 



device according to the present invention; 



25 



Figure 2 



The sequence of a method according to the present invention, on the basis of a 
block diagram; 



Figure 3 



The block diagram of a second embodiment of a diagnostic device according 
to the present invention. 



Description of the Exemplary Embodiments 
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Unles&ispecifically mentioned otherwise, identical or functionally equivalent elements have 
been provided with matching reference numerals in the figures of the drawing. 

Figure 1 shows the block diagram of a safety device having the diagnostic device according 
to the present invention. 

5 Reference numeral 1 in Figure 1 denotes the safety device. Here, safety device 1 is embodied 
as electronic restraining means, such as an airbag system. The safety device includes an 
airbag control unit 2 as well as a multitude of sensors 3 to 5. In the case at hand, safety device 
1 has one or more front sensors 3 and side sensors 4, 5 although it is also possible to provide 
rear sensors as well. The present invention includes a diagnostic device 6. Diagnostic device 
10 6 communicates bidirectionally, both with control unit 2 and sensors 3 to 5. Instead of a 
single diagnostic device 6 it would also be conceivable, of course, to provide each control 
unit 2 or each sensor 3 to 5 with its own diagnostic device 6. It would likewise be possible to 
implement the functionality of diagnostic device 6 into control unit 2. 

Diagnostic device 6 according to the present invention includes a comparator 7 as well as an 
15 output unit 8. 

In the following, the method according to the present invention is described in greater detail 
on the basis of the block diagram in Figure 2. 

A vehicle impact typically produces an acceleration (or velocity or pressure) in the x- and y- 
direction. Should a vehicle impact occur, these accelerations are detected by at least one of 
20 sensors 3 to 5. These accelerations in the x-direction and y-direction are each integrated into a 
velocity (degraded vehicle velocity DV), and a mean value is generated therefrom. This so- 
called degraded velocity DV or its mean value usually is used as measure for the impact 
severity. 

The installed and remote sensors 3 through 5 thus supply control unit 2 with information 
25 regarding their mechanical loading (pressure or acceleration) as a result of a vehicle impact. 
During the vehicle impact, control unit 2 ascertains the respective integral and peak values of 
the measured signals. The data thus obtained are compared to adjustable thresholds, which 
ultimately leads to a triggering of a restraining means. 
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6 



Furthermore, according to the present invention the degraded vehicle velocity, which is 
calculated from the maximum of the calculated x, y integrals of the measured acceleration, is 
utilized as a measure of the crash severity. These values for the crash severity are stored, for 
instance in a maximum amount memory. Following a vehicle impact, the content of the 
5 maximum-amount memory may be compared to a threshold specified by the vehicle 
manufacturer, which was determined in crash tests, for instance, which are conducted 
anyway. This comparison is implemented in comparator 7. If the predefined threshold is 
exceeded, control unit 2 or diagnostic device 6 will generate an error signal, which is 
indicated to the vehicle user in the form of a warning light 8, for example. In addition or as an 

10 alternative, this error-function signal may also be read out in a service facility by a service- 
facility testing device. Therefore, if a function-error signal is output, this indicates that airbag 
control unit 2 and/or the respective sensors 3 to 5 must be exchanged. If the maximum 
amount remains below the predefined threshold, and if control unit 2 or sensors 3 to 5 exhibit 
no faults in an internal self-test, the individual device may remain in the vehicle since it is 

1 5 considered fully functional. 

In this way vehicle manufacturers are able to define a threshold (such as DV = 30 km/h) at 
which control unit 2 should be replaced. Either in addition or as an alternative, each 
individual external sensor 3 to 5 may be tested using similar calculations, either in addition or 
as an alternative. Airbag control unit 2 may therefore decide for itself and for each remote 
20 sensor 3 through 5 whether a replacement is warranted after a vehicle impact. 

Although the present invention has been described above on the basis of the aforementioned 
preferred exemplary embodiment, it is not limited thereto, but may be modified in various 
ways. 

For instance, as illustrated in the exemplary embodiment in Figure 3, diagnostic device 6 
25 according to the present invention may also be implemented in control unit 2. Furthermore, 

comparator 7 and/or output unit 8 need not necessarily be included in diagnostic device 6, but 
may also be installed at some other location in the vehicle. 

Finally, the present invention is not limited to the number of control units 2 or sensors 3 to 5 
shown in Figures 1 and 3, but may be expanded to any number of such devices 2 to 5. 
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